IAS

[AJD]

I'm thinking of implementing a W2K RADIUS server for our
VPN users. I understand that the VPN server can then
authenticate against this RADIUS server. I'd like to
have it authenticate against active directory; however,
some of my VPN users won't necessarily be network users.
Therefore, yes I want to create VPN logins in AD, but I
don't want them to have access to other network
resources. Is there a way to create users in AD that
can't login to the domain, but I can still authenticate
using RADIUS?

any input would be appreciated.

 

[Stefan Buchman]

You should be able to create these logins in AD and then lock them
down through Group Policy denying them the 'Log in Interactively'
right. This will allow RADIUS to verify the credentials but the users
will be unable to login to a workstation that is a member of the
domain.

- Stefan